Classifications

• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K7/00—Methods or arrangements for sensing record carriers, e.g. for reading patterns
  • G06K7/10—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation
  • G06K7/10009—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves
  • G06K7/10297—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves arrangements for handling protocols designed for non-contact record carriers such as RFIDs NFCs, e.g. ISO/IEC 14443 and 18092
  • G06K7/10306—Methods or arrangements for sensing record carriers, e.g. for reading patterns by electromagnetic radiation, e.g. optical sensing; by corpuscular radiation sensing by radiation using wavelengths larger than 0.1 mm, e.g. radio-waves or microwaves arrangements for handling protocols designed for non-contact record carriers such as RFIDs NFCs, e.g. ISO/IEC 14443 and 18092 ultra wide band
• • G—PHYSICS
  • G01—MEASURING; TESTING
  • G01S—RADIO DIRECTION-FINDING; RADIO NAVIGATION; DETERMINING DISTANCE OR VELOCITY BY USE OF RADIO WAVES; LOCATING OR PRESENCE-DETECTING BY USE OF THE REFLECTION OR RERADIATION OF RADIO WAVES; ANALOGOUS ARRANGEMENTS USING OTHER WAVES
  • G01S13/00—Systems using the reflection or reradiation of radio waves, e.g. radar systems; Analogous systems using reflection or reradiation of waves whose nature or wavelength is irrelevant or unspecified
  • G01S13/02—Systems using reflection of radio waves, e.g. primary radar systems; Analogous systems
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
  • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
  • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
  • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
  • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
  • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
  • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
  • G06K19/0716—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips at least one of the integrated circuit chips comprising a sensor or an interface to a sensor
  • G06K19/0717—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips at least one of the integrated circuit chips comprising a sensor or an interface to a sensor the sensor being capable of sensing environmental conditions such as temperature history or pressure
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
  • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
  • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
  • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
  • G06K19/073—Special arrangements for circuits, e.g. for protecting identification code in memory
  • G06K19/07309—Means for preventing undesired reading or writing from or onto record carriers
  • G06K19/07372—Means for preventing undesired reading or writing from or onto record carriers by detecting tampering with the circuit
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
  • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
  • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
  • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
  • G06K19/077—Constructional details, e.g. mounting of circuits in the carrier
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
  • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
  • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
  • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
  • G06K19/077—Constructional details, e.g. mounting of circuits in the carrier
  • G06K19/07737—Constructional details, e.g. mounting of circuits in the carrier the record carrier consisting of two or more mechanically separable parts
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06K—GRAPHICAL DATA READING; PRESENTATION OF DATA; RECORD CARRIERS; HANDLING RECORD CARRIERS
  • G06K19/00—Record carriers for use with machines and with at least a part designed to carry digital markings
  • G06K19/06—Record carriers for use with machines and with at least a part designed to carry digital markings characterised by the kind of the digital marking, e.g. shape, nature, code
  • G06K19/067—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components
  • G06K19/07—Record carriers with conductive marks, printed circuits or semiconductor circuit elements, e.g. credit or identity cards also with resonating or responding marks without active components with integrated circuit chips
  • G06K19/077—Constructional details, e.g. mounting of circuits in the carrier
  • G06K19/07749—Constructional details, e.g. mounting of circuits in the carrier the record carrier being capable of non-contact communication, e.g. constructional details of the antenna of a non-contact smart card
  • G06K19/07798—Constructional details, e.g. mounting of circuits in the carrier the record carrier being capable of non-contact communication, e.g. constructional details of the antenna of a non-contact smart card part of the antenna or the integrated circuit being adapted for rupturing or breaking, e.g. record carriers functioning as sealing devices for detecting not-authenticated opening of containers
• • G—PHYSICS
  • G08—SIGNALLING
  • G08B—SIGNALLING OR CALLING SYSTEMS; ORDER TELEGRAPHS; ALARM SYSTEMS
  • G08B13/00—Burglar, theft or intruder alarms
  • G08B13/22—Electrical actuation
  • G08B13/24—Electrical actuation by interference with electromagnetic field distribution
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04B—TRANSMISSION
  • H04B1/00—Details of transmission systems, not covered by a single one of groups H04B3/00 - H04B13/00; Details of transmission systems not characterised by the medium used for transmission
  • H04B1/69—Spread spectrum techniques
  • H04B1/7163—Spread spectrum techniques using impulse radio
  • H04B1/7183—Synchronisation

Definitions

• the present invention generally relates to sealing systems, in particular for tamper-detection sealing of nuclear containers.
• a container lid is fixed to a container body and may comprise means for identifying the individual container.
• the invention further relates to a method of installing a sealing system.
• an inspection agency wishes to verify that a cask (container) containing nuclear spent fuel is transferred between two facilities without being opened. Transport casks are filled at a facility, transferred by truck, rail or boat to another facility and then re-opened.
• the inspector traditionally has access to the casks and lids at three different stages - before they are filled, during transfer and after the cask is opened and emptied.
• casks be filled under surveillance, closed by the operator and sealed by the operator, but no inspector from the agency is required to be present during the filling / closing / sealing operation.
• the seal applied by the operator must be conceived in a way to (i) avoid intentional/unintentional bad installation that will inhibit/alter the correct function of the seal, (ii) uniquely match cask and lid, (iii) detect an unauthorized opening during transport, (iv) avoid being cloned, and (v) store data and guarantee that the data has not been manipulated.
• prior solutions involve the use of passive loop seals (like the COBRA seal) or active electronic seals (like EOSS).
• COBRA seal passive loop seals
• EOSS active electronic seals
• a wire or fibre optic is passed through a fixture in the cask and in the lid when the cask is closed.
• the wire is connected to a seal.
• COBRA seal to open the cask the seal must be broken.
• EOSS seal openings are recorded internally in the seal.
• a disadvantage is that both previous systems rely on the correct wire installation on the fixtures on the cask. Also, a loose wire may allow the opening of the cask without detection by the seal. Further, the fibre optic wire may be damaged during transport, rendering the seal useless.
• the COBRA system requires an inspection before the cask is opened (seal broken) because there is no way to determine the time at which the seal was broken.
• a sealing system for sealing a container lid to a container body, said sealing system comprising: at least three tags adapted to be mounted to one of said container lid or said container body, each tag having a unique ID and comprising a first RF transceiver configured to transmit, in use, a respective first RF signal; at least three anchors adapted to be mounted to the other one of said container lid or said container body, each anchor having a unique ID and comprising a second RF transceiver configured to receive, in use, the first RF signals; and a master unit, coupled for communication with the at least three anchors; wherein the master unit is adapted to (i) determine, associated with the ID for each tag, a respective current 3D position, based on the received first RF signals, (ii) store previously determined 3D positions for each tag, and (iii) generate an alert and/or a timestamp and/or a log entry if it determines that separation between the current 3D position of one
• the master unit may have one of the at least three anchors integrated therein.
• the sealing system is placed on the casks and lid by an inspector, the system is transparent to the operator that will fill and close the casks. The operator does not have to perform any operation to install or activate the sealing system, so no mistake (intentional or unintentional) can be made.
• this sealing system is more secure: it requires less work by the operator, who will not have any extra activity, and requires fewer inspections from the inspectors of the agency, who can also inspect the sealing system at the most convenient time.
• Each of the anchors may be configured for transmitting, periodically or on command from the master unit, a second RF signal, the second RF signal comprising a timing signal.
• Each first RF signal may comprise a signal generated at a respective tag in response to the second RF signal and/or including an indication of the time of arrival at the tag of the second RF signal.
• the master unit may be configured for performing temporal averaging of the first RF signal and/or data indicative of the 3D position.
• the master unit may be configured for determining a time point at which the separation between the anchors and the tags has minimised, or stabilised.
• the anchors may be fixedly attached on the container at known locations, for example equally spaced on the circumferential periphery of the container, and the master unit is configured to determine, for each tag, a respective current 3D position based on the known locations.
• the master unit may be configured to determine, for each tag, a respective current 3D position using a triangulation algorithm.
• each tag and/or each anchor includes a real-time clock
• the first RF signal and/or the second RF signal incorporates a timestamp derived from a respective real-time clock
• each of said anchors is configured to transmit a combined signal to the master unit, the combined signal comprising a package for each of said at least three tags, each package including the tag ID and time of arrival data.
• Such transmission may e.g. be performed via a bus.
• each tag and/or each anchor and/or the master unit comprises a non-volatile memory (NVM) for storing said 3D positions, in association with respective tag IDs.
• NVM non-volatile memory
• each tag includes a first cryptographic module configured for generating and storing a first cryptographic key and/or first digital signature, and each tag is configured for signing said first RF signal using said first cryptographic key or first digital signature prior to transmission to an anchor.
• each anchor tag includes an optional second cryptographic module configured for generating and storing a second cryptographic key and/or second digital signature, and each anchor is configured for (i) signing said second RF signal using said second cryptographic key or second digital signature prior to transmission to a tag; and/or (ii) signing said combined signal using said second cryptographic key or second digital signature prior to transmission to the master unit.
• the second cryptographic key and/or second digital signature may be generated by the first cryptographic module.
• the digitally signed data can be stored locally or sent remotely by the master, without any risk of data alteration. An intermediate verification of the seal is not required, since all the events related to the lid closure or opening are stored and can be retrieved from a signed log in the NVM.
• each tag and/or each anchor includes a tamper detection sensor configured for generating, in the event of detection thereby of tampering with a housing of a tag or an anchor, tamper detection data indicative of said tampering with the housing.
• each tag and/or each anchor includes one or more batteries, coupled thereto, a voltage detection sensor configured for generating, in the event of detection thereby of exceptional voltage levels outside a first predetermined range, voltage exception data indicative of tampering with the battery or batteries.
• each tag and/or each anchor includes a temperature sensor configured for generating, in the event of detection thereby of exceptional temperature levels outside a second predetermined range, temperature exception data indicative of tampering with a tag or an anchor.
• each tag or anchor is attached to the container lid or container body, by a rigid tension belt, for example made of steel, plastic or composite
• each tag and/or each anchor includes a strain sensor, for example a strain gauge, adapted for sensing strain in the belt, the strain sensor being configured for generating, in the event of detection thereby of exceptional strain levels outside a third predetermined range, strain exception data indicative of tampering with a tag or an anchor.
• the master unit may include a long-range communications module, for example a cellular communications module, and may be configured, in response to the generation of the alert, to (a) generate a cask opened alert, optionally append thereto any data indicative of tampering with the housing, data indicative of tampering with the battery or batteries, temperature exception data and/or strain exception data, and (b) transmit the cask opened alert to a remote control location using the long-range communications module.
• a long-range communications module for example a cellular communications module
• the master unit may be configured, in response to a status request received from a remote control location using the long-range communications module, for transmitting a sealing system status report, the sealing system status report including the timestamp and details of any cask opened alert, and optionally any data indicative of tampering with the housing, data indicative of tampering with the battery or batteries, temperature exception data and/or strain exception data; wherein the sealing system status report is transmitted to the remote control location using the long-range communications module.
• a method of installing a sealing system comprising: providing a sealing system according to any of claims 1 to 14 of the appended claims; mounting the tags and anchors to the container lid and the container body respectively; and initiating the sealing system.
• Fig.1 is a disassembled view of a cask (container), having a sealing system according to a preferred embodiment of the invention mounted thereon;
• Fig.2 is a schematic block diagram of a tag or anchor used in the sealing system of Fig .1 ;
• Fig.3 is a schematic block diagram of a master unit used in embodiments of the invention.
• Fig.4 is a flow chart of software/firmware processes carried out in the elements in Fig. 1 according to an embodiment of the invention.
• the present invention seeks to provide a sealing system to be applied to nuclear dry storage casks that fulfils one or more of the following requirements: a. It shall operate automatically, unattended. b. It shall be used on the lid and body of nuclear containers, without any modification to the container body or lid and without interfering with normal loading/unloading procedures. c. It shall uniquely identify container body and container lid together as a single item (avoiding cloning). d. It shall be easily installed and removed. e. It shall detect any opening / closing of the container by removing the lid. f.
• I It can allow verification of the identity and integrity of the seal through inspection.
• m It can carry an identity which can be univocally coupled with the container; and
• n It is able to withstand harsh operating conditions.
• Fig.1 illustrates a disassembled view of a cask (container) 10, having a sealing system according to a preferred embodiment of the invention mounted thereon.
• the sealing system includes three electronic devices of a first type (A1 to A3; herein referred to as "anchors" 14, 16, 18) that are attached to the outer periphery of a container body 12 at its open end 20.
• the container body 12 is of the type, for example, to be filled with nuclear waste materials or other hazardous waste products.
• the three anchors 14, 16, 18 are linked and in communication via a wired connection, namely bus 22.
• a master unit 24 is linked via a further wired connection 28 to one of the anchors, in this case anchor 14.
• the functionalities and/or componentry of master unit 26 are incorporated into one of the anchors 14, 16, 18, for example anchor 14. This integration provides optimization and simplifies manufacture/setup.
• the anchors 14, 16, 18 are mounted on the container body 12 at known locations, e.g. equally spaced apart around the circumferential periphery of container body 12. Thus, in the case of three anchors 14, 16, 18, these are angularly spaced at 120 degree intervals. It will be appreciated, however, that four or more anchors 14, 16, 18 may be used around the periphery of container body 12, so that in the case of four anchors, these are angularly spaced at 90 degree intervals, and so on.
• the three anchors 14, 16, 18 are fixed to the container body 12 by a rigid tension belt (not shown), to prevent unauthorized removal.
• the sealing system according to this embodiment of the invention also includes, mounted on lid 13 of the container 10, three electronic devices of a second type (T1 , T2, T3; herein referred to as "tags" 30, 32, 34).
• the three tags 30, 32, 34 are fixed to the container lid 13 by a rigid tension belt (not shown). In the case that three tags 30, 32, 34 are present, these are angularly spaced at c. 120 degree intervals. It will be appreciated, however, that four or more tags 30, 32, 34 may be used around the periphery of container lid 13, so that in the case of four anchors, these are angularly spaced at c. 90 degree intervals, and so on.
• the sealing system comprising the anchors 14, 16, 18 and the tags 30, 32, 34, as well as master unit 26, is fixed to the container 10 prior to filling the container body 12.
• the filling and sealing of the container does not require the presence of an inspector.
• the anchors 14, 16, 18 and the tags 30, 32, 34 communicate with each other using Ultra Wide Band (UWB) radio frequency (RF) signals in order to determine device separation distances and/or positions in 3 dimensions (3D), as discussed in detail below. While, in this embodiment, UWB RF transceivers are used, it will be appreciated that non-UWB RF techniques may be employed.
• UWB Ultra Wide Band
• RF radio frequency
• FIG 2 shows a schematic block diagram anchor 14 used in the sealing system of Fig .1 .
• the tags 30, 32, 34 are similar devices to anchors 14, 16, 18 and share the same architecture, but are programmed differently, e.g. in firmware. For the sake of brevity, only the architecture of anchor 14 is discussed here; the tags 30, 32, 34 and anchors 16, 18 are constructed similarly.
• “device” may refer to each of tags 30, 32, 34, to each of anchors 14, 16, 18, or to any or all of these.
• the core of the device is a low power microcontroller 50, to manage all the information of the different subsystems of the device and to coordinate all the communications with other devices, including the master unit 26.
• the RF e.g. UWB
• UWB e.g. UWB
• ranging - to determine the relative 3D position of at least each of the tags 30, 32, 34 - is accomplished through a dedicated UWB module 52 that transmits and receives data packages (including time of flight (ToF) data) and timestamps, the latter being provided by real-time clock (RTC) 54.
• Real-time clock 54 is preferably a precise real time clock that keeps track of time for precise time-stamping of data (packages) / RF messages.
• the anchor 14 also contains a cryptographic module 56 (crypto-chip) that can generate and store cryptographic keys to digitally sign the data (packages) before being transmitted. That is, each tag and anchor is equipped with a cryptographic module 56 with a unique ID and its own unique private key, to avoid cloning. Keys are generated and stored in the crypto chip inside the device, for maximum protection. All the communications between the devices are digitally signed with an asymmetric algorithm for authentication.
• a cryptographic module 56 crypto-chip
• An anti-tamper sensor 58 detects if the anchor 14 is removed from its position on the container.
• the sensor 58 may be in the form of tamper detection switches on the case/housing (not shown) of the devices, and a protective circuit mesh (not shown) to avoid drilling into the case/housing.
• the anchor 14 is powered by one or more batteries 60 (preferably a dual battery system), and is provided with a set of sensors 62 to monitor voltage and temperature to ensure the correct functioning and detect tamper attacks.
• the temperature sensor is used to detect extreme temperatures that may alter the functioning of the seal. Through the use of the temperature sensor, processor 50 is able to determine whether the current temperature is within a predetermined operational range, and/or generate an alert/exception (message) when the sensed temperature is outside that predetermined operational range.
• the on-board voltage monitoring sensor ensures the correct power supply to the device.
• the voltage monitoring sensor is used to detect exceptional voltages output by battery 60 that may alter the functioning of the seal.
• processor 50 is able to determine whether the current voltage output is within a predetermined operational range, and/or generate an alert/exception (message) when the sensed voltage output is outside that predetermined operational range.
• the device also has a strain sensor (e.g. a strain gauge or similar sensor) to check or monitor the tension of the fixing belt (not shown) used to fixedly attach the anchors 14, 16, 18 to the container body and/or to attach the tags 30, 32, 34 to the container lid 13.
• the strain sensor is used to detect exceptional levels of strain in the fixing belt (not shown) that may be indicative of an attempt to remove the belt of devices (i.e. tampering).
• processor 50 is able to determine whether the current level of strain is within a predetermined operational range, and/or generate an alert/exception (message) when the sensed level of strain is outside that predetermined operational range.
• the anchor 14 keeps a log of all detected events, and/or all sensor data, in an internal non-volatile memory (NVM) 64.
• NVM 64 data stored in NVM 64 is preferably time-stamped using a precise timestamp from RTC 54.
• the anchor 14 communicates with the master unit (26; Fig. 1 ) through a wired communication link 28 (such as a serial or parallel link) using communication module 66.
• FIG 3 is a schematic block diagram of a master unit 26 used in embodiments of the invention. This is identical to the anchor 14 of Fig. 2, except as described in the following.
• the master unit 26 acts as a control unit for the sealing system.
• a communication module 66' identical to the communication module 66 of anchor 14 and operating on the same protocol, e.g. serial or parallel, is included, for communication with the anchor 14 via wired communication link 28.
• the master unit 26 includes a long-range communications module 70, for communication to and from a remote central control station (not shown), e.g. belonging to a nuclear safety agency.
• the long-range communications module 70 may be a cellular communications module 70, e.g. GSM, 3G, 4G, 5G/LTE or the like.
• anchors 14, 16, 18 initiate the communication with the tags 30, 32, 34, i.e. each anchor 14, 16, 18 has a communication exchange with each of the tags 30, 32, 34.
• the container lid 13 with three tags is positioned close to a container body 12 with three anchors 14, 16, 18, the container body 12 and lid 13 are effectively paired, and any relative movement of the lid 13 with respect to the container body 12 will be detected, including lifting and or rotation.
• Anchors 14, 16, 18 and tags 30, 32, 34 exchange data packages containing timing information. These packages are digitally signed, using cryptographic module 56 to avoid counterfeits.
• the master unit 26 collects all these data packages and calculates the time of flight of signals between anchors 14, 16, 18 and tags 30, 32, 34, and subsequently, through a triangulation algorithm, their relative (3D) positions. Sensors inside anchors 14, 16, 18 and tags 30, 32, 34 can detect if the device is removed from its position on the container 12. As discussed in more detail below, any attempt to lift the lid 13 is detected by the system and logged.
• the devices are "aware" of their respective position in 3D space and behave like a unique seal, i.e. unique to this container body 12 and lid 13 pairing.
• This "network" of 3D localized seal devices allows a precise detection of movement (of the devices, and therefore of lid 13, relative to container body 12), e.g. to an accuracy of about 5 to 15 cm.
• each of the three anchors 14, 16, 18 interrogates the three tags 30, 32, 34.
• Each anchor 14, 16, 18 can determine at which distance the tags 30, 32, 34 are positioned, using time of flight information.
• the three anchors 14, 16, 18 are placed around the container body 12 in a plane parallel to the surface of the container lid 13, preferably at 120 degrees angular separation round the circumference of the container body 12.
• Anchors 14, 16, 18 and tags 30, 32, 34 exchange messages to determine the time of flight. These messages are digitally signed, to prevent any other fake tag from impersonating a legitimate one.
• All the anchors 14, 16, 18 provide the distance information to the master unit 26 over the wired communication channel 28.
• the master unit 26 collects all the authenticated information and, through a triangulation algorithm, determines the 3D position of each tag 30, 32, 34.
• the position of the tags 30, 32, 34 can be determined by the master unit 26 therefrom.
• Three anchors 14, 16, 18 and three tags 30, 32, 34 is the minimum number to ensure a good 3D positioning.
• Four anchors 14, 16, 18 and four tags 30, 32, 34 may increase the precision of the 3D positioning, but at added cost/complexity.
• the master unit logs the proximity of the three tags 30, 32, 34 connected to the lid 13. Any change to the position of each tag (or change greater than a threshold distance [threshold 1 ], e.g. lying in the range of 0.1 to 15 cm, preferably 0.1 to 5 cm, more preferably 0.1 to 1 cm) is considered as an opening of the lid.
• An algorithm processes the position/distance changes relative to the detection threshold(s) and may average the position/distance overtime to avoid false alarms.
• FIG. 4 is a flow chart of software/firmware processes carried out in the elements in Fig. 1 according to an embodiment of the invention. That is, there are illustrated the steps or processes implemented at each tag 14, 16, 18, at each anchor 30, 32, 34, and at the master unit 26, in carrying out monitoring, detection of tampering with or opening of the cask (container) 10, and alerting. (For brevity, the process is described in relation to a single tag 30 and a single anchor 14; the process for the other tags and anchors is similar.)
• each tag 30, 32, 34 has its own unique identifier (ID), and using cryptographic module 56, tag 30 operates to generate a signature from the stored cryptographic key and tag ID (step s402).
• the tag 30 then listens for messages received via RF (step s404).
• step s406 if no message is received, tag 30 continues to listen for messages received. If, at step s406, it is found that an RF message has been received, a check is made (step s408) as to whether it is recognisable as an initiation message from an anchor 14. At step s408, if no initiation message has been received, tag 30 continues to listen for messages received (s404).
• each anchor 14, 16, 18 has its own unique identifier (ID), and using cryptographic module 56, anchor 14 operates to generate a signature from the stored cryptographic key and tag ID (step s430). Either periodically according to a preset periodicity using the real-time clock, or on command from the master unit 26, anchor 14 broadcasts (step s432) an initiation message to tags 30, 32, 34 in the vicinity, using UWB RF, the initiation message being designed to prepare tags 30, 32, 34 for 2-way communication and a 3D position determination operation.
• ID unique identifier
• anchor 14 broadcasts (step s432) an initiation message to tags 30, 32, 34 in the vicinity, using UWB RF, the initiation message being designed to prepare tags 30, 32, 34 for 2-way communication and a 3D position determination operation.
• tag 30 initiates (step s410) all sensors 58, 62 and communications modules 52, 66. The tag 30 then listens for a timing message via UWB RF. If, at step s412, it is found that no timing message has been received, tag 30 continues to listen for messages received (s404).
• the anchor 14 Following transmission of the initiation message by the anchor 14, and as seen in the central column in Fig. 4, e.g. a predetermined period thereafter, the anchor 14 broadcasts (s434) a timing message.
• step s412 determines (step s414) the time of arrival (ToA) of the timing signal using real-time clock 54 and timestamps the ToA based on the reading of the real-time clock 54.
• the ToA can subsequently be used to determine time of flight (ToF) from anchor 14 to tag 30.
• a data package containing the ID of tag 30 and the ToA are digitally signed using the generated signature for the tag 30.
• the signed data package is then broadcast by the tag 30 at step s418.
• step s436 At the anchor 14 (see central column in Fig. 4), after transmission of the timing message by the anchor 14, a delay timer is initiated (step s436), the delay being designed to permit reception of responses from tags 30, 32, 34 to the timing signal.
• step s438 A check is made (step s438) as to whether the delay has elapsed; and, if so, processing returns to step s432, where anchor 14 (re)broadcasts an initiation message to tags 30, 32, 34 in the vicinity.
• step s440 a determination is made (step s440) as to whether data packages (responses to the timing signal) for all tags 30, 32, 34 have been received by the anchor 14. If not, processing returns to step s438.
• step s440 If it is determined (step s440) that data packages for all tags 30, 32, 34 have been received, the signed data packages are decrypted (s442) to derive ToA and ID for Tag 30. In this case (3 tags), the 3 data packages (Tag IDs + ToAs) are compiled into combination package at step s444.
• step s446 the combination package is signed using the signature of anchor 14.
• step s448 the combination package is sent (step s448) to the master unit 26 as a signed data package.
• step s448 Following the communication (step s448) of the combination package to master unit 26, as signed data package, and the determination (step s460) that the combination package has been received, the signed combination package is decrypted (step s462).
• the ToA and ID for each tag is derived (step s464); the ToF for each tag is derivable from the ToAs, as will be known to persons skilled in the art.
• the timing message may comprise a precise timestamp indicating time of sending.
• the tag 30 applies a precise timestamp to the received timing message, indicating ToA.
• step s466 For each tag, its current 3D position is determined (step s466) from known locations of anchors 14, 16, 18 and the derived ToAs and IDs, using triangulation algorithm.
• step s468 the current 3D position is determined, then, for each tag, its current 3D position is compared (step s468) with the previously determined 3D position for that tag (stored in NVM 64; Fig. 2). A check is then made (step s470) as to whether the magnitude of the separation of current and previously determined 3D positions is greater than a first threshold (thresholdl ).
• the determined current 3D position for each tag is stored (step s472) in NVM 64.
• the master unit If, on the other hand, the magnitude of the separation is greater than the first threshold, indicating that substantial movement of the lid 13 relative to the container 12 (Fig. 1 ) corresponding to an act of tampering or (attempted) opening has occurred, the master unit generates (step s474) a "Cask opened” alert (message), including timestamp of opening; the alert is logged in NVM 64.
• step s476 optionally a check is made for any tag/device tampering, temperature, voltage or strain sensor exception data, i.e. from sensors 58, 62, respectively, and optionally this data is appended (step s478) to "Cask opened” alert (message).
• the three anchors 14 are fixed on the container body 12 using a rigid tension belt (not shown) under tension.
• Each anchor 14, 16, 18 can monitor the tension of the belt.
• the tension from the belt is released, and the master unit 26 detects the tampering, generating the strain gauge exception data.
• a similar detection system is in place on the belt (not shown) that fixes the three tags 30, 32, 34 to the lid 13. Similar appending action is performed in the event of tag/device tampering, temperature, or voltage level exception data.
• step s480 the "Cask opened” alert (message) is sent to remote central control (not shown) via a cellular network, e.g. GSM, 3G, 4G etc., using communications module 70 (Fig. 3) of master unit 26.
• a cellular network e.g. GSM, 3G, 4G etc.
• the master unit 26 is configured to be interrogated by an inspector with a suitable reader (not shown), e.g. via wired (serial/parallel) device port, or by short-range wireless communication, such as Bluetooth®.
• master unit 26 is provided with a remote communication module 70 that uses existing telecom infrastructure (i.e. GSM, GPRS, 3G or other system), allowing a remote interrogation of master unit 26, e.g. to obtain status data, logs and/or tampering reports/alerts.
• Such data may be securely communicated to a remote location/station in digitally signed form using the unique cryptographic key and the cryptographic module 56 of master unit 26.
• the duty of the inspector is to check that the initial installation of the fixing belt (not shown) of anchors 14, 16, 18 and tags 30, 32, 34 is correct.
• an inspector an inspector
• the sealing system 10 once in place, is autonomous. Once a lid 13 is placed close to a container body 12, the sealing system 10 detects the lid 13 and pairs it to the container body 12. Everything is automatic and wireless, and no wiring or any mechanical operation is needed. This means that the container is loaded and closed by the nuclear power plant operator without the presence of an inspector.
• the sealing system 10 can be remotely interrogated to check its status and access the internal log. Once the container is opened and emptied, the sealing system 10 can be removed from the container and sent back to the inspectors to be reused.
• anchor 56 cryptographic module 16 anchor 58 anti-tamper sensor 18 anchor 60 battery

Landscapes

• Engineering & Computer Science (AREA)
• Physics & Mathematics (AREA)
• Computer Hardware Design (AREA)
• Microelectronics & Electronic Packaging (AREA)
• General Physics & Mathematics (AREA)
• Theoretical Computer Science (AREA)
• Toxicology (AREA)
• Computer Security & Cryptography (AREA)
• Health & Medical Sciences (AREA)
• Computer Networks & Wireless Communication (AREA)
• Electromagnetism (AREA)
• General Health & Medical Sciences (AREA)
• Artificial Intelligence (AREA)
• Computer Vision & Pattern Recognition (AREA)
• General Engineering & Computer Science (AREA)
• Radar, Positioning & Navigation (AREA)
• Remote Sensing (AREA)
• Signal Processing (AREA)
• Arrangements For Transmission Of Measured Signals (AREA)
• Radar Systems Or Details Thereof (AREA)
• Processing Of Solid Wastes (AREA)
• Details Of Rigid Or Semi-Rigid Containers (AREA)
• Alarm Systems (AREA)
• Burglar Alarm Systems (AREA)
• Emergency Alarm Devices (AREA)
• Refuse Collection And Transfer (AREA)

Priority Applications (11)

Applications Claiming Priority (2)

Publications (2)

Family

ID=55854612

Family Applications (1)

Country Status (12)

Cited By (2)

Families Citing this family (3)

Citations (3)

Family Cites Families (23)

• 2017
  • 2017-04-13 ES ES17717436T patent/ES2804253T3/es active Active
  • 2017-04-13 LT LTEP17717436.4T patent/LT3465548T/lt unknown
  • 2017-04-13 AU AU2017251920A patent/AU2017251920B2/en not_active Ceased
  • 2017-04-13 KR KR1020187033924A patent/KR102124784B1/ko active IP Right Grant
  • 2017-04-13 WO PCT/EP2017/059021 patent/WO2017182398A1/en active Application Filing
  • 2017-04-13 RU RU2018140910A patent/RU2723273C1/ru active
  • 2017-04-13 JP JP2018555207A patent/JP6861731B2/ja active Active
  • 2017-04-13 BR BR112018071410A patent/BR112018071410A8/pt not_active Application Discontinuation
  • 2017-04-13 EP EP17717436.4A patent/EP3465548B1/en active Active
  • 2017-04-13 CN CN201780028364.2A patent/CN109074506B/zh not_active Expired - Fee Related
  • 2017-04-13 US US16/095,682 patent/US10552649B2/en not_active Expired - Fee Related
  • 2017-04-13 CA CA3021134A patent/CA3021134C/en active Active

Patent Citations (3)

Also Published As

Similar Documents

Legal Events